Working with Security and Compliance in OMS

In this chapter, we will take a comprehensive look at the Security and Compliance solution offering in OMS, and explore the OMS Security and Audit solution, related solutions, and security-related capabilities in OMS. We will cover the following topics:

• Using the Security and Audit solution
• Understanding Security and Audit data
• Using the Antimalware Assessment solution
• Using Baseline Assessment
• Using the Update Management solution

Introduction

Growing and ever-changing security threats are some of the toughest challenges that organizations face today. As threat actors and defenders adapt to the exponential growth of business data, and advances in technology and security-related capabilities, the need for organizations to implement a coherent cybersecurity strategy is greater than ever. As IT security and operations team grapple with the challenges of managing and securing highly complex, cross-platform, and hybrid cloud systems that are increasingly subject to a rising number of sophisticated cyber attacks, organizations are coming to terms with the reality that a security strategy that revolves around traditional, perimeter-based defenses alone is no longer a sound strategy. This outdated strategy should be supplanted by cybersecurity that is cloud-enabled and based on, among other things, real-time analysis...

Using the Security and Audit solution

The OMS Security and Audit solution is one of the key capabilities of the Security and Compliance offering in OMS. The Security and Audit solution provides a comprehensive view into the IT security posture of your organization by enabling you to monitor your environment for potential threats and vulnerabilities. The Security and Audit solution uses built-in search queries and intuitive visualizations to highlight security issues that should be addressed. With threat intelligence, malware detection, and other security capabilities, the solution provides you with increased visibility to prevent, detect, and respond to various security threats. In this section, we will explore the Security and Audit solution and the various solution features and capabilities.

...

Understanding Security and Audit data

Recall that, as part of the Security and Compliance solution offering in OMS, the Security and Audit solution is designed to provide you with a unified view of all security-related issues detected in your environment. The solution therefore weaves together data from disparate but related sources and solutions in your workspace, and leverages information from the intelligent security graph to unlock insights and enable you to prevent, detect, and remediate security threats in your environment. You can explore Security and Audit data by using the built-in solution visualizations, which enable you to interact with the underlying queries and resulting security records. You can also perform query operations using the query language to query security-related data in your OMS workspace.

...

Using the Antimalware Assessment solution

The Antimalware Assessment solution in Log Analytics enables you to monitor the status of Antimalware protection in your environment. The solution detects whether supported antimalware solutions are installed on your machines, and whether the solutions are operational. You can install this solution from the Solutions Gallery in your OMS workspace or add it to your Log Analytics through the Azure marketplace in the Azure Portal.

How to do it...

If you haven't completed the How to do it section in the Using the Security and Audit solution recipe, you can follow these steps:

Adding the...

Using baseline assessment

Security baseline assessment is one of the assessment capabilities of OMS Security. The Security and Audit solution uses this capability to help you assess how compliant your machines are with an established configuration for highly secure server deployments.

This assessment is part of the Security and Audit solution. You will need to install the Security and Audit solution to access this capability in your OMS workspace. Note that baseline assessment supports both Windows and Linux machines.

How to do it...

Perform the following steps to use security baseline assessment:

Adding the Security and Audit...

Using the Update Management solution

The Update Management solution in OMS is part of the Automation & Control offering. Update Management identifies missing system updates and orchestrates the installation of these updates across Windows and Linux servers, both in your data center and in any public cloud. The Update Management solution supports both update assessments and, using automation, update deployments on supported operating systems.

Getting ready

To use the Update Management solution, ensure you do the following:

• Create and configure an Azure Automation account.
• Ensure that machines are running supported operating systems. See the Supported operating systems subsection.
• Target machines with Windows agents should...